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Abstract 

We consider a generalization of the standard oracle model in which the oracle acts on the target 
with a permutation which is selected according to internal random coins. We show new exponential 
quantum speedups which may be obtained over classical algorithms in this oracle model. Even stronger, 
we describe several problems which are impossible to solve classically but can be solved by a quantum 
algorithm using a single query; we show that such infinity-vs-one separations between classical and 
quantum query complexities can be constructed from any separation between classical and quantum 
query complexities (in the unbounded-error regime). 

We also give conditions to determine when oracle problems — either in the standard model, or in any of 
the generalizations we consider — cannot be solved with success probability better than random guessing 
would achieve. In the oracle model with internal randomness where the goal is to gain any nonzero 
advantage over guessing, we prove (roughly speaking) that k quantum queries are equivalent in power to 
2k classical queries, thus extending results of Meyer and Pommersheim, and Montanaro, Nishimura and 
Raymond. 

1 Introduction 

Oracles are an important conceptual framework for understanding quantum speedups. They may represent 
subroutines whose code we cannot usefully examine, or an unknown physical system whose properties we 
would like to estimate. When used by a quantum computer, the most general form of an oracle is a possibly 
noisy quantum operation that can be applied to an n-qubit input. However, oracles this general have no 
obvious classical analogue, which makes it difficult to compare the ability of classical and quantum computers 
to efficiently interrogate oracles. This was the original motivation of the standard oracle model, in which / 
is a function from [N] = {1, . . . , N} to {0, 1}, and the oracle Of acts for a classical computer by mapping 
x, y to x, y © f{x), and for a quantum computer as a unitary that maps \x, y) to \x, y © f{x)). One way to 
justify the standard oracle model is that if there is a (not necessarily reversible) classical circuit computing 
/, then Of can be simulated by computing /, XORing the answer onto the target, and uncomputing /. This 
model is depicted in figure [TJ 

In this paper, we consider other forms of oracles that are more general than the standard oracle model, 
but nevertheless permit comparison between classical and quantum query complexities. Meyer and Pommer- 
sheim [T] generalized the standard model by letting A be a deterministic classical algorithm which takes the 
control x of the oracle and computes a value A{x). The oracle then acts by applying a permutation ~ka(x) to 
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Figure 1: An oracle in the standard model 
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Figure 2: An oracle in the internal randomness model 



the target. We will further generalize the model by replacing A with a randomized classical algorithm. The 
random coins used by A are internal to the oracle and cannot be accessed externally. We call this concept 
an oracle with internal randomness. A general oracle with internal randomness is shown in figure [5J Note 
that even if there are no controls as in figure [31 such an oracle can still be interesting since it may apply 
different permutations depending on its internal coin flips. 

Oracles with internal randomness correspond naturally to the situation in which a (quantum or classical) 
computer seeks to determine properties of a device which acts in a noisy or otherwise non-deterministic 
manner. One simple example is an oracle that "misfires" , i.e. when queried, the oracle does nothing with 
probability p and responds according to the standard oracle model with probability 1 — p. This model 
was considered in [2] , which found, somewhat surprisingly, that the square-root advantage of Grover search 
disappears (i.e. there is an fi(iV) quantum query lower bound for computing the OR function) for any 
constant p > 0. 

The rest of our paper is divided into two parts. First, we explore various examples of oracles with internal 
randomness that demonstrate the power of the model. We will see that in some cases, this can even result 
in problems solvable with one quantum query that are completely unsolvable using classical queries. The 
basic idea behind these oracles is first demonstrated in Section [2] where we contrast the consequences of the 
various oracle models by considering the problem of determining whether two sets are equal or disjoint. This 
problem is further generalized in Section [4] to several group-theoretic problems: determining membership in 
the same coset, equivalence of orbit cosets, and distinguishing permutations with certain cycle structures. 

In the second part, we consider the question of when oracle problems can be solved with any nontrivial 
advantage; i.e. a probability of success better than could be obtained by simply guessing the answer according 
to the prior distribution. For an example of when such advantage is not possible, consider the parity function 
on N bits. If these bits are drawn from the uniform distribution, then any classical algorithm making < N— 1 
queries will not be able to guess the parity with any nontrivial advantage. In Section we consider the 
problem of when some number of queries are useless for solving an oracle problem. Informally, our main result 
is roughly that that k quantum queries are useless (in a way we formalize later) if and only if 2 A: classical 
queries are useless. However, a subtlety arises in our theorem when oracles have internal randomness, in 
that the 2k classical queries need to be considered as k pairs, each of which uses a separate sample from the 
internal randomness of the oracle. 

Special cases of our result had been previously obtained by Farhi, Goldstone, Gutman and Sipser [3], 
who proved the result for the case of the parity function; by Meyer and Pommersheim [3], who proved that 
if 2k classical queries are useless for the permutative oracle model then so are k quantum queries, and by 
Montanaro, Nishimura and Raymond [5], who proved the equivalence in the standard oracle model when / 
has binary output, using techniques that do not readily generalize to non-binary /. Our proof is arguably 
simpler and more operational. We introduce an analogue of gate teleportation [6] for oracles by showing that 
oracles can be (a) encoded into states analogous to Choi-Jamiolkowski states, and (b) retrieved from those 
states with an exponentially small, but heralded, success probability. We expect that this characterization 
will be useful for future study of query complexity in the regime where any nonzero advantage is sought. 
We conclude by leveraging our encoding to obtain a generalized method of constructing of problems with 
infinity-vs-one query complexity separations from any problem which has a separation between the classical 
and quantum query complexities and discuss how this can be extended to the bounded-error model (though 
this comes at the price of increasing the number of quantum queries). 
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2 The loops problem 



Let 7Ti and tt2 be permutations on [N] which are given as black boxes. We think of each iri[N/2] = L, 
as the exponentially large loop which consists of the edges Wi(k) -H- Ki(k + 1) for each k <E [JV/2 — 1] and 
TTi(N) o 7Tj(l). We are promised that either 

• Li and L2 are disjoint or 

• ii and L2 contain the same nodes 

The loops problem is to decide which of these is the case. This is a variant of the collision problem [8]. 
The key difference is our requirement that 7ri,7T2 (thought of as maps from [A/2] to [N]) be injective, which 
will later make it possible to encode them in non-standard oracles. 

In the rest of this section, we explore encodings of the loops problem using different oracle models, with 
an eye towards establishing stronger quantum-classical query complexity separations than can be achieved 
with the standard model. We will see that several models permit fast quantum solutions, but not all of them 
admit fair comparisons with classical algorithms. 

2.1 Formulation using unitary oracles 

The most natural way to formulate this problem precisely is to provide each 7Tj as a black box unitary 
oracle [Zj. Unlike oracles in the standard model which take a control x and compute f{x) which is then 
XORed into the target as shown in figure [TJ unitary oracles have no controls but may perform an arbitrary 
unitary operation on their input. The classical analogue is a black box that applies a permutation to a target 
register. Although this problem is hard classically in this formulation, there is a simple quantum algorithm 
(see Algorithm [T|) which makes this model uninteresting. The probability that this algorithm returns the 
correct answer can be made arbitrarily close to 1 by increasing the accuracy of the phase estimation used to 
perform the inversion. 

Algorithm 1 A quantum algorithm for the unitary black box formulation 
1: Compute Ui |1) = |tti(1)) 

2: Using phase estimation [5], construct tj\ which is a good approximation of \j\ 
3: Measure Jj\ |7Ti(l)) in the computational basis 
4: if the outcome k is in [N/2] then 
5: Return "Li = i 2 " 
6: else 

7: Return "Li ^ L 2 " 
8: end if 



2.2 Formulation using randomized and quantum oracles 

Another approach is to encode tt\ and 7T2 into probability distributions. In this formulation, we make a 
distinction between the classical and quantum versions of the oracles. The classical oracle Pi for 7^ outputs 
a value from Li which is chosen uniformly at random; the quantum version of the oracle performs the 
analogous operation of preparing the state \Li). 

To justify this formulation, we think of oracles as being generated by circuits whose internal structure is in 
principle accessible, but in practice we do not know any way to access this structure besides evaluating it. If 
such a circuit has random elements, then in some cases, we can modify it to produce a coherent superposition 
of outputs instead of a random mixture. The paper 10 calls this task q-sampling and describes several general 
scenarios in which this is possible. Another general model is when a probability distribution is specified by 
a data structure such as a Bayesian network. If this data structure is known, then it is again possible to 
construct a quantum circuit that q-samples from the appropriate distribution. 
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Figure 3: An oracle in the internal randomness model with no controls 

However, in general, q-sampling requires substantial additional assumptions about how the oracle is 
constructed. Thus either the classical algorithms can also exploit this additional structure, or the quantum 
algorithm has an unfair advantage. 

2.3 Formulation using indistinguishable oracles 



Consider again the formulation of the loops problem in Section 12.11 The main feature of the formulation 
which allows a quantum algorithm to succeed using phase estimation to invert one of the unitary oracles 
is that the labels 1 and 2 of 7Ti and 112 are known to the algorithm designer. To see this, we can think of 
the algorithm designer as having a box filled with different devices which perform unitary operations and 
measurements; he is also given two black box devices which implement tti and 7T2 and have labels marking 
them as "7Ti" and "7^". To solve the problem, the algorithm designer prepares a quantum state and then 
takes a device out of the box and applies it to the state; after using it once, the device is placed back inside 
the box. By repeating this process with different devices, the algorithm designer can invert one of the unitary 
oracles and solve the problem. Suppose that we consider the same problem except that the labels tt\ and 
7T2 on the devices have been erased so that the two devices now look exactly the same. In this case, the 
algorithm designer can no longer perform phase estimation since after he uses one of the unitary oracles once 
and puts it back into the box, he will not be able to find the same oracle again without having a 50% chance 
of using the wrong oracle by mistake. We now focus on finding an oracle model in which we can implement 
this scenario. To do this, it is necessary to use an oracle with internal randomness. 

2.4 Formulation of the loops problem using oracles with internal randomness 

The idea is to "erase" the labels of tti and 7r2 by encoding both of them in a single oracle which acts as 
shown in Algorithm [2] Note that this oracle has no controls and is of the form shown in figure [3] 

Algorithm 2 The oracle for the loops problem 
1: Flip an internal fair coin 
2: if the outcome is heads then 
3: Apply 7Ti to the target 
4: else 

5: Apply 7T2 to the target 
6: end if 

Using the fair coin to select which permutation to apply is analogous to erasing the labels on the devices 
for 7Ti and ~ki and putting each of them back into the box after each use in the scenario discussed above. 
This problem is hard in a classical setting as we will show. Our quantum algorithm for the loops problem is 
based on the swap test [TT] which we now introduce. 

Let and \4>) be two states which we wish to compare. The swap test is performed by preparing a qubit 
|c) in the state (|0) + |1)) and applying a swap controlled by |c) to the states \ip) and \<j>). A Hadamard 
is then applied to the control qubit and a measurement is preformed in the computational basis. A simple 
calculation shows that the probability of measuring (symmetric) is 

Pr(0) . i±KM£ (1) 
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If = \(f>), then the swap test will always return 0. However, if (il>\4>} = then will be observed with 
probability 1/2. Thus, the swap test allows these two cases to be distinguished with one-sided error. In the 
sequel we refer to outcome as the "symmetric" outcome and 1 as the "antisymmetric" outcome. 

We now show how this problem may be solved by a quantum algorithm (see Algorithm [3]) based on the 
swap test [llj . 

Algorithm 3 The quantum algorithm for the loops problem 

l: Prepare the pair of states \a) and |/3) by applying the oracle O to J~~^ J2x=i \ x ) 

2: Apply the swap test to \a) and 

3: if the swap test returns "symmetric" then 

4: Return "L\ = L 2 " 

5: else 

6: Return ll L\ ^ L 2 " 
7: end if 



Theorem 1. There is a quantum algorithm which solves the loops problem using 0(1) queries and 0(logN 
elementary operations with success probability at least 2/3. 

The proof of the next theorem is straightforward but long so we defer it to Appendix [B] 

Theorem 2. Randomized algorithms require Q(\/N) queries to solve the loops problem with success proba- 
bility > 2/3. 

3 Infinity-vs-one separations 

In this section, we discuss problems which can be solved using a single quantum query but cannot be 
solved classically even with an unlimited number of queries. To achieve such infinity-vs-one separations it is 
necessary (but not sufficient) for the oracle to have internal randomness since otherwise one could simulate 
the quantum algorithm classically with exponential overhead. The key point is that internal randomness 
effectively causes a different oracle to be used for each query so such a simulation is not possible in this case. 

3.1 Distinguishing involutions with no fixed points from cycles 

We describe the problem of distinguishing involutions from cycles. Compared to the oracles discussed 
previously, this problem has several distinct properties: 

• Classically, the problem cannot be solved even with an unlimited number of queries to the oracle. 

• The problem can be solved by a quantum algorithm using only one query. 

• In other words, the problem admits an infinity-vs-one separation between the classical and quantum 
query complexities. 

Define INV = {ir G Sn \ tt 2 — l and irx ^ x for all x £ [A]}; this is the set of involutions in Sn with no 
fixed points. Let CYC = {tt E Sn\ tt is a cycle of length N}. For any nonempty subset S of Sn, define Os 
to be the oracle with a control x € [N] and a target y € [N] which acts according to Algorithm fJJ 

Theorem 3. Classical algorithms cannot solve the problem of distinguishing cycles from involutions with no 
fixed points with unbounded error using any number of queries. 

Proof. In this problem, an oracle Os is given which is either Ojnv or Oqyc', the problem is to determine 
which of these is the case. Consider querying the oracle when the control is x. Then tt{x) is a uniformly 
random value in [N] \ {x} for both cases so this problem cannot be solved by a classical algorithm. □ 
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Algorithm 4 The oracle for the problem of distinguishing involutions with no fixed points from cycles 
1: Select 7r 6 S uniformly at random 
2: Compute 7r(x) where x is the value of the control 
3: Add ir(x) to the target y modulo N 



However, the problem can be solved by a quantum algorithm using a single query to the oracle as shown 
in Algorithm [5j 



Algorithm 5 The quantum algorithm for distinguishing involutions with no fixed points from cycles 

1: Prepare the state Ylx=i \ x ) 

2: Apply Os to obtain the state Y2 x =i l 2 -' 71 "^)) 

3: Perform the measurement {M xv }x< w<y <N where M xy = \xy) (xy\ + \yx) (yx\ 

4: Let M xy be the measurement outcome and let be the residual state. 

5: Measure in the lEM^lE} basis 

6: if the outcome is Isil^^sl then 
7: Return "INV" 

8: else 

9: Return "CYC" 

10: end if 



The measurement {M xy } has measurement outcomes that range over all x < y. We omit the subspace 
spanned by the states \x,x), since we are promised that tt has no fixed points, and so our states will have 
no overlap with this subspace. To implement the measurement, we use Algorithm [6] 



Algorithm 6 Implementing the measurement {M xy } 

1: Let the input be \w, z) 

2: Compute \w, z) ® \m\a.{w, z\, maxjw, z}) 

3: Measure the last two registers; the measurement outcome is {x = minju), z}, y — max{w, z}} 



Algorithm [5] may be simplified by applying the swap directly to the state Yl x =i ^i^) as shown in 
Algorithm [7] 

We now show that the above algorithm effectively counts the number of transpositions in an arbitrary 
permutation which is sufficient to distinguish involutions from cycles. 

Theorem 4. Quantum algorithms can solve the problem of distinguishing cycles from involutions with no 
fixed points using a single query with one-sided error 1/2. 

Proof. Consider a general state p AB on two identical systems A and B. Then applying the swap test to this 
system (where the swap exchanges A and B) outputs (symmetric) with probability 



Pt( 0) = l±«f* (2, 

where F is a swap operation. Applying this formula to the state X^^Li \ x ' 7r ( a: ))j the probability of 
observing is 
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Algorithm 7 The simplified quantum algorithm for distinguishing involutions with no fixed points from 
cycles 

1: Prepare the state -7= Yl x =i \ x ) 

2: Apply Os to obtain the state J2 x =i \ x ^ n ( x )) 

3: Apply the swap test to ^-7= J2x=i l x 7 7r ( a; )) 

4: if the swap test outputs "symmetric" then 

5: Return "INV" 

6: else 

7: Return "CYC" 
8: end if 



l + (l/N)j: {-K(y)\x){y\n(x)) 

Pr (o) = 2 ( 3 > 

= 1 + (1/AQ \{{x, y)\ tt(x) = y and n(y) = x}\ ^ 

This probability is 1/2 if it G CFC and is 1 if tt G INV. □ 

Hence, there is an infinity-vs-one separation in the unbounded-error classical and quantum query com- 
plexities for this problem. 

This analysis also shows that if the oracle Os in Algorithm [7] is replaced by an oracle which always applies 
the same permutation 7r (which is now an arbitrary element of Sn), then an estimate may be obtained for 
Pr(0) by repeatedly applying the swap test to the state -7= 2x=i \ x ' 7r ( x ))- This in turn will allow an 
estimate to be obtained for number of pairs (x,y) such that w(x) — y and 7r(y) = x. Note that each fixed 
point of 7r is counted once in this value while each transposition (x y) is counted once for the pair (x, y) and 
once for the pair (y, x). To obtain an estimate for the number of transpositions, the number of fixed points of 
7r can be estimated by repeatedly performing the measurement {\x, x) (x, x\} on the state ^7= Y2x=i \ x > 7r ( a; ))- 
This may then be combined with the estimate for | {(x, y)\ ir(x) = y and ir{y) = x}\ to obtain an estimate 
for the number of transpositions in n. 



3.2 An infinity- vs-O(n) separation for a modification of Simon's problem 

We now show how to modify Simon's problem |12j to obtain an infinity- vs-0(n) separation between the 
classical and quantum query complexities. Recall for Simon's problem, we are given oracle access to a 
function / : — > and f(x) = f(y) if and only if x — y + a for some fixed element oGZJ and our task 
is to determine a. Classically, exponentially many queries are required; however, quantumly at each step 
we learn a vector which is orthogonal to a so that the expected number of queries required is G(n). The 
crucial point here is that this algorithm will return a vector orthogonal to a for any / which is constant 
and distinct on the cosets {x,x + a}, so if / changes between calls to the oracle and a does not, then the 
quantum algorithm will not be affected. 

Our randomized oracle is defined as follows. Fix some unknown a £ ZJ. Then construct an oracle 
O a ■ \x) \y) (-> \x) \y + f(x)) where / : Z£ —> 1^ IS selected uniformly at random at each call subject to the 
constraint that f(x) = f(y) if and only if x = y + a. The problem is then to determine a. 

Classically, this cannot be done since each query to the oracle results in a random number; however, the 
quantum algorithm still requires only O(n) queries. 
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3.3 An infinity-vs-one separation for the hidden linear structure problem 

Beaudrap, Cleve and Watrous [TS] introduced the hidden linear structure problem where we are given a 
blackbox which performs the mapping \x) \y) i— > \x) \n(y + sx)} where n € S q and s £ GF(q) for q — 2™. The 
problem is to find s. By extending quantum Fourier transforms to GF(q), Beaudrap, Cleve and Watrous 
[15] show that this problem can be solved exactly using a single quantum query but classical algorithms 
require fl(^/q) queries to determine s. They are able to achieve such a query complexity separation by using 
a non-standard (but still deterministic) oracle model. In the 10 years since their paper, it is still an open 
question whether such separations are possible in the standard oracle model. 

We propose the following randomized variant of their oracle problem. Fix some (unknown) s € GF(q). 
Then define the oracle by O s : \x) \y) H ► |x) \it(y + sx)) where 7r is elected uniformly at random for each 
query. The goal is still to determine s. Since the quantum algorithm only uses one query it is unaffected by 
this change; however, classically the output of the oracle is completely random at each query so we obtain 
an infinity-vs-one separation. 

3.4 Generalized construction from problems where one classical query is useless 
but one quantum query is not useless 

The previous three separations are examples of a more general phenomenon in which randomness can be 
used to amplify a modest quantum- vs-classical query separation into an unbounded one. 

Let {Ci} be disjoint classes of functions such that a single classical query to the deterministic classical 
oracle Of : \x) \y) i— > \x) \y © f(x)) is useless (ie, yields no information) for determining which Ci contains / 
but that this can be determined by a single quantum query with bounded (or one-sided) error. Let Oi be 
the oracle which selects a / € Ci using the prior distribution on / and acts by bitwise XOR according to /. 
Suppose we are given an oracle Oi and the problem is to determine i. It can be shown (see Section |6]) that 
this is impossible classically even with an unlimited number of queries but is possible with bounded error 
using only one quantum query. 

This amplification works whenever a single quantum query can solve the problem and a single classical 
query provides no information at all about a problem. However, as we have seen with Simon's problem, it is 
sufficient for a single quantum query to make progress towards solving the problem, e.g. learning a random 
vector orthogonal to a. Note that this construction also works if the original oracle has internal randomness 
which is used to select a permutation. In Section [BJ we will show how to generalize this technique to amplify 
any separation between classical and quantum query complexities into an infinity-vs-one separation (though 
this comes at the price of increased probability of error) . 

3.5 The problem of distinguishing involutions with no fixed points from cycles 
cannot be generalized to A;-wise independent permutations 

Consider the oracles Oinv and Ocyc- As mentioned before, querying either oracle for a single value results 
in a random output so the permutations in the sets INV and CYC are essentially^] 1-wise independent 
permutations. However, the permutations in these sets are not 2-wise independent since a cycle cannot 
contain a transposition and in the case of an involution with no fixed points 7r(7r(a;)) is determined once ir(x) 
is known. An interesting question is then if the algorithm can be generalized to the case of two disjoint sets A 
and B of fc-wise independent permutations for k > 2. For tt G S, let O^ denote the version of Os which has 
been derandomized by forcing the permutation selected to always be w. Since k > 2, two classical queries to 
O n will not yield any information about whether n was selected from A or B. Meyer and Pommersheim [4] 
showed that if 2k classical queries to a deterministic oracle yield no information (in which case they are said 
to be useless) then k quantum queries are also useless. This shows that a single quantum query to O v is 
useless so repeated queries to the oracle Os each followed immediately by a POVM measurement cannot 

1 This is a slight abuse of terminology since for the permutations to truly be 1-wise independent it would be necessary for 
every value x to be mapped by a random permutation to a uniformly random value in [N] whereas in this case it is mapped to 
a uniformly random value in [N] \ {x}. 
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solve the generalized problem. The question now becomes whether it is possible to solve this problem by 
making a POVM measurement after making multiple queries to Os- We now generalize the result of Meyer 
and Pommersheim to the case of oracles with internal randomness. In particular, this shows that no quantum 
algorithm can distinguish O a from Ob so that the generalized problem cannot be solved by any algorithm: 
either classical or quantum. 

4 Generalizations 

We now explore generalizations of the loops problem and investigate their quantum speedups. 
4.1 Coset equivalence testing 

Let tti, ir 2 be chosen as in the loops problem. Now consider the permutations a on [N] such that ~k\ — ~k 2 o . In 
the case where Ki[N/2] = ir 2 [N/2], it must be that a e S[ N /2] © S (n / 2 ,n]- However, if 7Ti[JV/2] n n 2 [N/2] = 
then <r[N/2] = (N/2, N] and <r(N/2, N] = [N/2] so that a G 4>(S[ N / 2 ] © S( N / 2 ,n\) where 4> is any permutation 
that swaps the elements of [N/2] and (A/2, A]. The loops problem is then to determine the coset S , [at/2] © 
S(n/2,n] or 4>(S[N/2] © S(n/2,n]) t° which a — tt 2 1 tti belongs. Equivalently, the loops problem is to decide 
if a € Sm/2\ © S(pf/2,N] which is the case precisely when tti and ir 2 are in the same coset. This motivates 
the following coset equivalence problem. Let G be a group where H < G. Let g\,g 2 € G in analogy to the 
permutations tti and n 2 in the loops problem. The problem is to determine if g\ and g 2 are in the same 
coset of G/H. More precisely, the formulation is as follows: 

• G and H are given as blackbox groups and \H) can be prepared efficiently 

• Inverses cannot be calculated 

• An oracle O is provided (see Algorithm [SJ which randomly multiplies the target g € G by g\ or g 2 

• The goal is to decide if g\H = g 2 H 

The requirement that \H) can be initialized efficiently is not too restrictive; for instance, if (K) = H < S n 
then the state \H) can be created in time polynomial in \K\ and n [13] . 

Algorithm 8 The oracle for coset equivalence testing 
l: Flip an internal fair coin 
2: if the outcome is heads then 
3: Multiply the target by g\ on the left 
4: else 

5: Multiply the target by g 2 on the left 
6: end if 



This problem may then be solved in the same way as the loops problem as shown in Algorithm [9] 

Algorithm 9 The quantum algorithm for the coset equivalence problem 
1: Prepare the pair of states \a) and |/3) by applying the oracle O to \H) 
2: Apply the swap test to \a) and \0) 
3: if the swap test returns "symmetric" then 
4: Return " gi H = g 2 H" 
5: else 

6: Return "gxH ^ g 2 H" 
7: end if 



Note that the restriction that inverses cannot be calculated in G is rather artificial; however, this issue 
can be resolved by generalizing the problem to orbit cosets. 
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4.2 Orbit coset equivalence testing 

Section B~T1 showed how to test if two elements of a group G described by an oracle are in the same coset. 
However, the loops problem is not a special case of coset equivalence testing since [N] is not a group. The 
coset equivalence testing problem can be thought of as a group G acting on an isomorphic group G' in the 
natural way. We now generalize this to the case of a group acting on a set. Let G be a group which acts 
faithfully on a set X and has a subgroup H. Let 31,52 G G be specified by an oracle which acts randomly 
on the target (an element of X) using g\ or gi- The precise formulation is as follows: 

• G and Hx are given as part of the input and the description of Hx is powerful enough that \Hx) can 
be prepared efficiently 

• An oracle O is provided (see Algorithm IT0|) which randomly acts on the target y € X by g\ or 92 

• The goal is to decide if g\Hx — g-ilix 

We can think of the action of element of H as a permutation of X; thus, we may regard H as a subgroup 
of Sx- Let (K) = H . The state \Hx) can then be prepared in time polynomial in \K\ and \X\ |13j . 



Algorithm 10 The oracle for orbit coset equivalence testing 
l: Flip an internal fair coin 
2: if the outcome is heads then 
3: Act on the target by g\ 
4: else 

5: Act on the target by 32 
6: end if 



Algorithm 1111 solves this problem in the same way as before. 



Algorithm 11 The quantum algorithm for the orbit coset equivalence problem 
1: Prepare the pair of states \a) and |/3) by applying the oracle O to \Hx) 
2: Apply the swap test to |a) and |/3) 
3: if the swap test returns "symmetric" then 
4: Return u g\Hx = gzHx" 
5: else 

6: Return "gxHx ^ g 2 Hx" 
7: end if 



Note that both the loops problem and the coset equivalence problem may be thought of as special cases 
of this problem by choosing the correct group action. Thus, the separation between classical and quantum 
query complexities for the loops problem also applies to the orbit coset equivalence problem. 

Corollary 5. There exists an orbit coset equivalence testing problem such that there is an D,(^/N) vs 0(1) 
separation between the classical and quantum bounded-error query complexities 

5 Uselessness for oracles with internal randomness 

We now turn to the general problem of when some number of queries are useless for solving an oracle problem. 
Equivalently we can ask when it is possible to answer an oracle problem with any positive advantage over 
guessing. The minimum number of queries required to achieve nonzero advantage has also been called the 
unbounded error query complexity (see e.g. [5]) by analogy with PP, the complexity class in which the 
correct answer needs to be output only with probability > 1/2. 
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\y) Ttx,r 



Figure 4: An oracle in the internal randomness model 



To define oracle problems, we use a slightly more compact notation than in previous sections. An oracle 
7r is defined by a collection of permutations n x ,r £ Sm, where x £ [N] is input by the algorithm, and r is the 
internal randomness which is distributed according to R. Overloading notation, we say that if the oracle is 
queried k times, then r = (n, . . . , rfc) is distributed according to R k , which may not necessarily be an i.i.d. 
distribution. 

To describe the problem we want to solve, we follow the notation of Meyer and Pommersheim 1 while 
adding internal randomness to the oracle. We are promised that our oracle belongs to a set C, which in 
general may be a strict subset of all functions from [N] x supp(i?) to [M], The set C is partitioned into 
sets {Cj}, and our goal is to determine which Cj contains tt. By an abuse of notation, we say that C is our 
oracle problem. Queries are made to an oracle which acts as shown in figure 2) We will assume that tt 
is distributed according to a known distribution \x. 

Before stating our own results, we describe the main result of [4j. In their model there is no internal 
randomness, so the action of the oracle is simply tt x £ Sm for each x £ [N]. If x = (x%, . . . , Xk) and 
y = [y\, . . . , yk), then define ir x (y) = (ir Xl (yi), . . . , 7r Xk (?/&))• Their result may then be stated as follows. 



Definition 6 (Classical uselessness [1]). k classical queries are useless for the oracle ■problem C and distri- 
bution n if for all x £ [N] k , y £ [M] k and z £ [M] k , 



for all j , where the probabilities over tt are taken with respect to Li. 

Definition 7 (Quantum uselessness[4]). k quantum queries are useless for the oracle problem C and distri- 
bution fx if for any k-query quantum alqorithm run on any initial state and any POVM measurement {M 8 } 
which is made on the output of the algorithm 



for all j and s, where the probabilities over tt are taken with respect to /x. 

The main result of [4] is the following theorem. 

Theorem 8 (Classical uselessness implies quantum uselessness 4 ]). For any deterministic oracle problem 
C, [x, if Ik classical queries are useless then k quantum queries are useless. 

We will give an alternate proof of this theorem, establish a converse, and generalize it to oracles with 
internal randomness. 

5.1 Definitions of Classical Uselessness 

In order to characterize uselessness for oracles with internal randomness, we first need to extend the def- 
initions to this case. As above, we define TT x ^ r {y) — (7i"xi,ri(j/i)j • • ■' !r x k ,r k (yk))- One natural definition of 
uselessness in this setting is that a classical algorithm ignorant of the oracle's internal randomness should 
not be able to gain any nontrivial advantage in learning which Cj contains tt. 

Definition 9 (Weak classical uselessness). IfC,[x is an oracle problem, then k classical queries are weakly 
useless if for all x £ [N] k and all y,z £ [M] k , 



Pr(TT £ Cj | TT x (y) = z)= Pr(7r £ Cj) 



(5) 



Pr(7r € Cj | s) = Pr(n £ Cj) 



(6) 
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Pr(vr e Cj | tt. iP (v) = z) = Pr(n G Cj) 



(7) 



for all j , where the probabilities over tt are with respect to \i and over r are with respect to R k . 

It is easy to see that if 2k classical queries are weakly useless then k quantum queries need not be useless 
since Algorithm [7] is a counterexample. A much stronger definition of uselessness would be to allow the 
classical algorithm to see, or equivalently to choose, the internal random bits used by the oracle. 

Definition 10 (Strong classical uselessness). IfC, [i is an oracle problem, then k classical queries are strongly 
useless if for all x G [N] k , y,z G [M] k and all possible values r G supp(i? fe ), 

Pr(7r G Cj | n Xtr {y) = z) = Pr(7r G Cj) (8) 
for all j , where tt is distributed according to fi. 

We will see later that strong classical uselessness for 2k queries is sufficiently powerful to imply quantum 
uselessness for k queries. However, it is in fact too strong, so the definition must be weakened as follows. 

Definition 11 (Pairwise classical uselessness). If C, /i is an oracle problem, then 2k classical queries are 
pairwise useless if for all x,x' G [N] k and y,y',z,z' G [M] k 

Pr(7r G Cj | ir m , r (y) = z,n x ,, r (y') = *') = Pt(tt G Cj) (9) 
for all j where tt is distributed according to fi and r is distributed according to R k . 

This definition ensures that each pair of query values (2^,2;^) shares the same random seed fj. We will 
see later that this corresponds precisely (in the unbounded error setting) to the power of quantum queries, 
because the density matrix resulting from a quantum query depends on only one random seed, while the 
different row and column indices can interrogate two different choices of x, y. 

We observe that strong classical uselessness implies both weak classical uselessness and pairwise classical 
uselessness. However, weak classical uselessness and pairwise classical uselessness are not comparable: there 
exist problems which satisfy weak classical uselessness but not pairwise classical uselessness and vice versa. 
Section [3 . 1 1 gives an example where two classical queries are weakly useless but not pairwise useless. For an 
example of a problem where two classical queries are not weakly useless but are pairwise useless, let C be the 
set of all balanced binary functions and let / is chosen uniformly at random from C. Consider the task of 
determining the function implemented by the oracle which acts for the i th query by \x) 1— > \x ® where 
r, is the i th random seed; let r\ be uniformly distributed in {0, 1} and let Vi — for i > 2. Clearly, two 
classical queries with the random seeds r± and ri determine /. However, two classical queries which share 
the random seed T\ yield no useful information. 

We now consider the dependence of uselessness on the distribution over the oracles. Consider an oracle 
problem C, /1. Each of the definitions of uselessness (weak, strong, pairwise or quantum) states that the 
condition Pr(7r G Cj \ Q) = Pr(7r G Cj) holds for all j and Q (where the values for Q depend on the 
definition we consider). Since we assume that supp(/i) = C, we may rewrite this as Pr(Q | tt G Cj) = Pr(Q). 
This is equivalent to the assertion that for any Q, Pr(Q \ tt G Ci) — Pr(Q | tt G Cj) for all i and j. Now, 
Pr(Q I tt G Cj) depends only on R k and the conditional distribution fj,(ir | tt G Cj). Thus, uselessness does 
not depend on the distribution over the classes G Cj). 

We will show by example that uselessness can depend on the conditional distribution of the oracle within 
each class. Let C be the set of all standard oracles for a function / : [N] —> {0, 1}. Let us partition C into 
Co and C\ and b is the parity of the functions in Cf,. Suppose that [i is the uniform distribution over C. 
Clearly, N — 1 classical queries are useless. By Corollary Q21 ["^F^J quantum queries are useless. Suppose 
that we design \i such that /u(C ) = fi(Ci) but f(l) is the parity of / with probability greater than 1/2. 
Then clearly one query (classical or quantum) is not useless. 

Our main result in this section is the following equivalence: 
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Theorem 12. For any oracle problem C, fj,, k quantum queries are useless if and only if 2k classical queries 
are pairwise useless. 

For deterministic oracles, weak, pairwise and strong classical uselessness are all the same. In this case, 
Theorem [T3] can be simplified to the following strengthening of Theorem [HJ 

Corollary 13. For any deterministic oracle problem C, (J,, k quantum queries are useless if and only if 2k 
classical queries are useless. 

As mentioned in the introduction, corollary Q2] was proved for the parity function by [3] , and for the 
standard oracle model with binary functions (i.e. M = 2) by [5]. Since their proof technique used the 
polynomial method |14j . it does not readily generalize even to non-binary functions. 

5.2 Encoding oracles in states 

In this section we will prove Theorem [TH Our strategy will be to show that in the unbounded-error setting, 
the optimal algorithms for query complexity make a series of fixed queries and then measure the resulting 
states. The key ingredient is to show that oracles can be encoded in states in a way that is perfectly efficient 
in terms of queries (i.e. one oracle call creates one state, and one state simulates one oracle call), albeit at 
a cost of producing algorithms the output "I don't know" most of the time. 
We define these encodings first for deterministic oracles. 

Definition 14. Let be a deterministic permutation oracle that maps \x,y) £ C N <E) C M to \x,Tr x (y)). 
Then define the encoding of 7r to be 

|Vv):=^=L= J2 \x) x \y) Y K(y)f (io) 

ye[M] 

Here X, Y, Z label different registers for notational convenience. 

Clearly one use ofO^ allows the creation of one copy of \ip n ); simply prepare the state -j== J2 X y \x) \y) Y \y)' 
and apply to registers XZ. We will see shortly that one copy of can in turn simulate one use of 
Ot Ti albeit with a very high, but heralded, failure probability. Before proving this result, we show how 
Definition 1141 generalizes to oracles with internal randomness. 

Definition 15. Let be an oracle whose action is defined by 

O t {\x) (x'\ <g> \y) (y'\ = E \x) (x'\ ® K r (y)) (^ v (y')l 

For each r, define the deterministic oracle O^.r by 

On,r \x,y) = \x,% x>r (y)) 

and define the encoding for fixed r to be 

ivo : = 7^ E \ x ) x \y) Y \^Av)f ■ (ii) 

ye[M] 

Now we define encodings of oracles with randomness. 
Definition 16. If is an oracle with internal randomness, then define the encoding of O n to be 

p„:=E^ ir . (12) 
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In this last definition, we use the convention that ip := \ip)(tp\. 

The utility of considering encodings comes from the following operational equivalence. 



Theorem 17. 1. One use of can create one copy of p^. 

2. It is possible to consume one copy of p v and simulate with success probability 1/NM 2 . The simu- 
lation outputs a classical flag indicating success or failure. 
In both cases, the run time required is linear in the number of qubits, i.e. 0(logNM). 

We point out that in the simulation, failure destroys not only the encoding, but also the state input to 
the oracle. Nevertheless, this simulation is enough to distinguish the case when k queries are useless from 
the case when they are not. 

Additionally, Theorem [17] is stated implicitly in terms of a distribution R. In the case of k correlated 
queries, we have the following variant: 

Theorem 18. 1. k uses of (correlated according to R ) can create 



2. It is possible to consume p k and simulate k uses of (correlated according to R ) with success 
probability l/N k M 2k , again with a flag indicating success or failure. 

As an corollary, for correlated internal randomness in the unbounded-error scenario, we can permit 
algorithms to make the k oracle calls in any order. 

We will prove Theorem [18] only, since it subsumes Theorem [17] 

/ , X Y Z\® k 

Proof. To create p k , we simply apply O v k times to [yj^ Y.x, y \ x ) IV) \v) ) ■ 

For the second reduction, suppose we are given a copy of p k and would like to apply to simulate the 
i th query of some algorithm. If we condition on r, then p k becomes the state ® **" ® ip-K.r k - We will 
use the i th component of this state to simulate our query. 

Suppose we want to simulate the action of 7T)Ti on the state \x') X \y') Y . Define 



Since AA^ = J2 x \x)(x\ = In, it follows that A^A < In 2 m 2 and {A,Vl — A^A} comprise valid Kraus 
operators for a quantum operation. Our simulation will apply this operation, with outcome A labeled 
success, and Vl — A^A labeled failure. 

Upon outcome \/ 1 — A^ A, the algorithm declares failure. If this occurs at any step of a multi-query 
algorithm, then the algorithm should guess j according to the a priori distribution p. Thus, for the purposes 
of determining whether the algorithm outperforms the best guessing strategy, it then suffices to consider 
only the cases when outcome A occurs. 

Upon outcome A, \^p 7T r .) XYZ \x') X \y') Y is mapped to the (unnormalized) state ^^ M2 \ x ') Wx,^ {y')) Z ■ 
Since the normalization is independent of the input, this means that A occurs with probability 1/NM 2 
regardless of the input state. Conditioned on this outcome, the resulting map is precisely the action of 0- n ^ i . 

We say that the overall algorithm succeeds when each of the k queries succeeds. Since each query 
independently succeeds with probability 1/NM 2 , the overall algorithm succeeds with probability 1 / 'N M 2k . 



Armed with our notion of encoding, it becomes straightforward to characterize when k quantum queries 
are useless. 




E hp n ,n ® • • • ® VwJ- 




□ 
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Corollary 19. Define <jj := E^gcTj p\. Then k quantum queries are useless if and only if all the (Jj are the 
same. 

Proof. By Theorem [TH1 any fc-query algorithm can WLOG create p k , resulting in the state o~j if ir is drawn 
randomly from Cj. The algorithm then proceeds to determine which Uj it holds, using no further oracle 
queries. If all the Uj are equal, then it can learn nothing about j. Conversely, if some o~j is different from 
the others, then there is a measurement which will be able to guess j with positive advantage. □ 

To conclude the proof of Theorem [121 observe that the quantity on the LHS of ([9]) is precisely 

tt{\x){x'\®\y){y'\®\z){z'\) £ M (tt)^ (13) 

= tt{\x){x'\®\y){y'\®\z){z'\)a j (14) 

which will be independent of j for all x, x', y, y' , z, z' if and only if all of the <jj are identical. 
Combined with Corollary \W[ this completes the proof of Theorem [T21 

Theorem 20. Suppose that for some oracle problem k classical queries are weakly useless but k quantum 
queries are not useless. Then there exists an oracle problem in which this separation holds where the oracle 
acts by bitwise XOR. 

Proof. Consider an oracle problem C, p for which k classical queries are weakly useless but k quantum queries 
are not useless. The oracle acts by O : \x) \y) H> \x) \^ x ,n{y)) on the i th call. We can define a new oracle 
O' : \x) \y) \z) h-> \x) \y) \z (B n x ^ ri (y)) . Our new oracle O' can be used to prepare the encoding for O so 
k queries to O' can simulate any quantum algorithm which uses k queries to O. Classically, O' can be 
simulated using O so we conclude that k classical queries to O' are weakly useless. We have proven the 
following: □ 

6 Amplifying query complexity separations 

We now leverage our results to obtain a general method of amplifying any separation between classical and 
quantum query complexities. Let C, p be an oracle problem where C is partitioned into {Ci} and rj is the 
j th random seed. For each tt £ C, we have an oracle O^. Suppose that for this problem there is a separation 
between the classical and quantum unbounded query complexities. Then for some k, k classical queries are 
weakly useless but k quantum queries are not useless. Let us define the oracle Oi : \xi) ■ ■ ■ \xk) \yi) • ■ ■ \yk) ^ 
\xi) ■ ■ ■ \xk) \^xi,ri (yi)) • • • \^x k ,r k (j/fe)) where 7r is selected from Ci according to p (this is done independently 
for each query), r is distributed according to R k and a fresh random seed r is used for every query to Oi. 
Consider the problem of determining i where the oracle Oi is given with probability p(ir € Ci). 

Theorem 21. Any number of classical queries to the oracle Oi is weakly useless for determining i; thus no 
classical algorithm can determine i with unbounded error no matter how many queries are made. 

Proof. Clearly, a single query to Oi is equivalent to k queries to the original oracle which are weakly useless 
by assumption. We conclude that a single classical query to the new oracle is weakly useless. We now show 
that t classical queries are weakly useless for any I > 1 . Let Xj € [N] k , yj, Zj £ [M] k and let each Tj be 
sampled independently from R k where 1 < j < i. We must prove that 

Pr(* I =z j ,j = l,...,e) = Pr(i) (15) 

where each tt j is sampled independently from Ci according to p. This condition is equivalent to 

Pr« 3 , PJ (Vj) = zj , j = 1, . . . , £ | i) = Pr« j ^ ( Vj ) = Zj , j = 1, . . . ,£) (16) 
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Note that by construction, IV;-;. ,. ;y, i = Zj,j = 1, . . . ,£ \ i) = \ \, I ':(-;. ,. (y , ; = Zj | i). By our 



assumption that k classical queries to the original oracle are weakly useless, we have that Pr(i | n Xj _ rj (yj) = 
Zj) = Pr(i) or equivalently Pr(ir Xjirj (yj) = Zj \ i) = ,. ; y , : = Zj). Therefore, 

PrK^doO = = !,•••>*) = E Pr ( 7r W%) = = I *) Pr ( J ) ( 17 ) 

= e fn pr (<^) = ^ i oj pr (*) 

= e fn pr (<,^%) = pr ( j ) ( i9 ) 

= n Pr (<,r,(»j) = «i) (2°) 

IJl'r;-;. ,. ;y ; i -., i) (21) 

i 

= Pr(4. iT ,.(y i ) = ^,i = l,---^IO (22) 

which is the desired result. □ 



We conclude that no matter how many classical queries are made to Oi, no information is obtained about 
i. On the other hand, we have the following result: 

Theorem 22. A single quantum query to Oi is not useless for determining i; equivalently, the unbounded- 
error quantum query complexity is 1. 

Proof. One can use a single quantum query to Oi to construct the state p k as described in Theorem [18] 
Applying Theorem llSl this state may be used to guess i with higher probability than random guessing since 
k quantum queries are not useless. □ 

Thus, we have constructed an infinity-vs-one separation in unbounded-error classical and quantum query 
complexities from an arbitrary initial separation. We now show how to obtain a infinity-vs-one separation 
in the bounded-error regime from an arbitrary separation between unbounded-error classical and quantum 
query complexities. Consider the oracle Oi as defined above. By Theorem there exists a single-query 
quantum algorithm A, a POVM {M s } and an i' such that for some s, Pr(i — i' \ s) > Pr(i — i'). Equivalently, 



Pr(s \i = i')> Pr(s) (23) 

Pr(s | i = 0(1 - Pr(« = i')) > Pr(s \i^i') Pr(i ^ i') (24) 

Pr(s | * = *')> Pr ( s \ i T Li ') ( 25 ) 
Pr(s \i = i') =Pr(s \i£i')+e (26) 

for some e > 0. Consider the problem of deciding if i = i' by querying Oi. By running A some large 
number of times T and using majority voting and Chernoff bounds, we may decide if i = i' with bounded 
error. Although T may be quite large, the gap is large since it is a separation between an infinite number of 
classical queries and a finite number of classical queries. 

Corollary 23. The bounded- error quantum query complexity of deciding if i = i' using Oi is finite. 

By Theorem [2T1 Pr(i | (yj) = Zj,j = 1,...) = Pr(i) for all £ > 1 and Xj £ [N] k , y j; Zj £ [M] k . 

Thus, Pr(i = i' \ ni^ r .(yj) = zj,j = 1, . . .) = Pr(i = i') and Pr(i ^ i' \ ni.^.(yj) = Zj,j = 1,...) = Pr(i ^ 
i') so ^ queries are weakly useless for deciding if i = %' . 
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Corollary 24. Any number of classical queries to the oracle Oi is weakly useless for deciding if i — i' ; thus 
no classical algorithm can decide if i — i' with unbounded error no matter how many queries are made. 

We can construct a new oracle 0[ which simulates T queries to Oi using an independent random seed 
for each query. From this we obtain the following. 

Corollary 25. The bounded-error quantum query complexity of deciding if i — i' using Oi is I. 

Corollary 26. Any number of classical queries to the oracle 0[ is weakly useless for deciding if i — i' ; thus 
no classical algorithm can decide if i = i' with unbounded error no matter how many queries are made. 

Thus, we have constructed an infinity- vs-one separation between the bounded-error quantum query com- 
plexity and the unbounded-error classical query complexity from an arbitrary initial separation. This comes 
at the price of large inputs for the constructed oracle. 



Acknowledgments 

DJR was funded by NSF grant CCF-0916400 and by the DoD through an NDSEG fellowship. AWH was 
funded by NSF grants CCF-0916400, CCF-0829937, PHY-0803478, DARPA QuEST contract FA9550-09-1- 
0044 and the IARPA MUSIQC and QCS contracts. We thank an anonymous reviewer for suggesting the 
infinity- vs-one separation for the problem in [15] . 



A Alternate proofs of uselessness 

In this appendix, we present alternate proofs of various uselessness theorems. These proofs do not rely on 
the idea of encoding oracles into states, but instead give direct arguments. First we prove that pairwise 
classical uselessness implies quantum uselessness. 

Proof. The proof is an extension of the technique used by Meyer and Pommersheim. Suppose that 2k 
classical queries are pairwise useless. Consider an oracle it which acts by 0\ : \x, y, z) H> \x, ir x . ri , z) for the 
i th query. Note that, as before, the variables may obey an arbitrary joint distribution so different queries 
are not necessarily independent. Consider an arbitrary /c-query quantum algorithm with initial state po and 
POVM {Ms}. For the i th query, the algorithm queries the oracle and then applies an arbitrary unitary 
transformation Ui. This yields the final state 

p. = U k O k v . . . U x Olp Q O l Jul . . . O k Jut (27) 
Let us fix the random seed used for the i th query as r,*. The final state is then 

Pir,r = U k P rk . . . U,P ri p Pt U\... P} k U\ (28) 

where P Ti denotes the permutative action \x,y, z) > \x,TT x ^ ri (y), z) of the oracle when the random seed 
is fixed to ri. Let A be a matrix, L = (x, y, z) and L' = (x' ', y' , z'). Then 

(P rt APl) LL , = (x,TT-^(y),z\A\x',7r-,] ri (y'),z') (29) 

= J 4 7 r., ri (L),7r., ri (L') (30) 

where n., ri (L) — (x, 7r~J.. (y), z). Then the state after the i + 1 th query (for the fixed values r of the 
seeds) is 
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Pi+l,r = U i+1 P ri+1 Pi <r P}. +1 U} +1 (31) 

so that the matrix elements are 

(Pi+l,r)L,L' = X! ( U i+l)L,K(Pi,r)n.,r i+1 (K),n., ri+1 (K')(U i+1 )K>,L> (32) 
K,K' 

This value is a function of L, L' , ir. iri+1 (K) and ir. iri+1 (K'). Therefore, the final state p n , r = pk, r may 
be written as 

Pv> r = ^2Ql( w x > r(y),^x' < r{y')) ( 33 ) 

where / = (L\, . . . , Lk, L\ . . . , LJJ. Let E^eC, denote the expectation over ir according to the distribu- 
tion Pr(-7T | 7r G Cj ). Then for any j, 

E Px,r = V E Qj(7r ai , P (y),7r 1B /, P (v / )) (34) 

7r|ir6Cj ^"p 7r|7reCj 

= VV E Q/(7r a!>I .(y),7r a ./ )I .(y / ))k a! ,r(y) = iw,7i"x',r(y') = ^'D (35) 

/ TO, TO' 

where u; = (w\, . . . , Wfc) and to' = (w[, . . . , wjj.) 

= ~y] "Y] Qi(w,w') E [7ra., r (y) = w,n X ',r{y') = w']) (36) 

1 TO, TO 

= 51 ™') Pr (^T(y) = *», T«',r (v 7 ) = to' k g Cj) (37) 

/ TO, TO' 

(38) 

Taking the expectation over the random seeds r, 

E E/w = V V Qi{w,w')EPr(ir a: , r {y)=w,n x ,,r{y')=™' I^C,) (39) 

7 TO, TO' 

= 5Z 51 Q/(™V)Pr(7T*,r(y) =tB,7T 1B /, r (v / ) =*»' | 7T G Cj) (40) 

= ^2^2 Q/(u>,u/)Pr(7r € Cj | 7r x , r (y) = w,n x ,, r (y') = w') (41) 

Pr(7Tx,r(j/) = w,n x ^ r (y') = w') 

Pr(TTGQ) 1 J 

= 5Z 5Z ™') PT (^Ay) = w > nx'Av') = w ') I 43 ) 

/ w.iv' 

by pairwise classical uselessness 

= EEV V Qi(w,w')[w Xir (y) = w,ir x , ir {y') = w'] (44) 

/ TO, TO' 

= EEVQ j ^ t ( ! /),VtW) (45) 

7r r ^ — ' 

= EEp 7r . r (46) 

(47) 
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Defining p n = E r p T>r , this may be written as 



E p„=E P7T (48) 

7r|7reCj 7T 

Note that for a random n <G C, the state after running the algorithm is E„- Pjt and for a random it e Cj 
the state is E^ 7TeCj p-n- Now, consider the probability that 7r € C 3 given the measurement outcome s. We 
have 

Pr(7r e Cj | s) = — K —i ^ (49) 

= "'" £Cj ^ Pr(^ e Cj ) (50) 

= Pr( 7 reC J ) (51) 

as claimed. □ 

Next, we prove that quantum uselessness implies classical uselessness, but in the special case of standard 
oracles that act via XOR but with internal randomness. Specifically, consider an oracle which acts by 
Oj : \x,y,z) i ^ \x, y ® f(x, n), z) for the i th query. As before, we allow the n variables to be drawn from 
an arbitrary joint distribution. 

Proof. Suppose that k quantum queries are useless. This means that for any POVM {M s } and quantum 
algorithm run on any initial state p , Pr(/ e Cj | s) = Pr(/ G Cj) for all j. Since Pr(/ e Cj \ s) = 

Pr(s|/eC,-)Pr(/eC 7 ) ,, . . ,. ,, 

— u p 3 r ^ u — 3 —, this implies that 

Pr( S | / € Cj) = Pr(s) (52) 

for all j. Let us choose the initial state 

(\ <g>k 
I^I^^I^IO)^) (53) 
x,x' 1 

and the algorithm defined by the unitary operator 0^ =1 Of. The result of running the algorithm assuming 
a particular function / and fixed seeds r is then 

fe 



^^E^^M^/O^)! ( 55 ) 

z— 1 x,x' 

For a particular function /, the state after running the algorithm is 



pf=Ep ft r (56) 

V 

1 k 

2—1 X.X' 
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Now 



Pr(s) =EPr(s | /) (58) 

= tiM s E Pf (59) 

= tr M sPc (60) 

Similarly, 

Pr(s \ f £ Cj) = E Pr(s | /) (61) 

= trM s E p f (62) 

= \xM a p Cj (63) 
Since Pr(s / e Cj) = Pr(/ e C 3 ), this implies that 

trM s (p c . -p c )=0 (64) 

for a/Z POVMs {M s } which means that 

PCj = Pc (65) 

^ E E (g) £ |s, f(x, n)) (x', f(x', n)\ = ± EE(g) \x, f(x, r,)> (a/, /(a/, r<)| (66) 

Equating the ((#1, yi, . . . , {%i •> y'\-> * • * ? elements of these matrices, we have that 

E E [/(as, r) =y, /(a:', r)-i/'] r)=y, /(a;', r) = i/] (67) 
r /l/ec 3 t / 

EPr(/(a:, r) = y, f(x', r) = y' \ f e C,-) = EPr(/(aj, r) = y, /(x', r) - y') (68) 

r r 

Pr(/(x, r) = y, /(x', r) = y' \ f G C-) = Pr(/(x, r) - y, /(*', r) = y') (69) 
Applying Bayes' rule, we have 

Pr(/ e Cj , ,<„„ - , - v, - P '^^;Xn^' {feC " <™> 

= Pr(/ € Q) (71) 

which is precisely the definition of pairwise classical uselessness in the case of oracles that act by XOR. □ 

Combining this with Theorem II 2\ we have the following result 

Corollary 27. For any oracle problem C, p in the standard model with internal randomness, k quantum 
queries are useless if and only if 2k classical queries are pairwise useless 

Since pairwise classical uselessness is equivalent to classical uselessness when / is deterministic, we have 
the following corollary. 

Corollary 28. If k quantum queries are useless for an oracle problem C',p in the standard model, then 2k 
classical queries are useless. 
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B A classical lower bound for the loops problem 



We now prove Theorem [2j 

Proof. We can think of each query x to the oracle tt = (tt\, 7r 2 ) as returning the pair of values {tt\(x), 7t 2 (;e)} 
as this can only reduce the number of queries required. Let oracle instances such that L\ = L 2 be called yes 
instances and oracle instance for which L\ ^ L 2 be called no instances. A definition is now required. 

Definition 29. Two queries x and y are a yes collision if 

• TTi(x) = n 2 (y) or m(y) = 7r 2 (a;) and 

• x, y £ [N/2] or x, y £ (N/2, N] . 

Two queries x and y are a no collision if 

• 7i"i (2;) = 7r 2 (y) or 7Ti(y) = 7r 2 (ir) and 

• x £ [N/2] and y £ (N/2, N] or x £ (N/2, N] and y £ [N]. 
A collision is either a yes collision or a no collision. 

Consider a sequence x\, . . . , xt of distinct queries with T < -j . Note that if a collision has occurred, 
then we have a yes instance for a yes collision and a no instance for a no collision. Otherwise, it cannot be 
determined with certainty whether an instance is a yes or no instance. Let T\ be the number of queries Xi 
in [N/2] and T 2 be the number of queries in (N/2,N] so T = T\ + T 2 . Suppose there have not been any 
collisions. Consider the possible yes instances that are consistent with the values queried so far. The first 
step is to choose the rest of the values in ni[N/2] = 7r 2 [7V/2]. Since there have not been any collisions yet, 
the T queries resulted in 2T distinct values (T each for m and 7r 2 ). Because the images of 7Ti and 7r 2 on 
[N/2] are the same, there are N/2 — 2T\ images in 7Ti[iV/2] = 7r 2 [iV/2] to choose from N — 2T possible values. 
There are (N/2 — T\)\ ways to permute the N/2 — T\ images of 7Ti on [N/2] which are not specified by the T 
queries. Similarly, there are (N/2 — T 2 )! ways to permute the N/2 — T 2 images of 7Ti on (N/2, N] which are 
not specified by the T queries. Similar statements hold for 7r 2 . Thus, the number of consistent yes instances 
is 

Kyes = [ N/2 2T J (N/2 - T 1 )! 2 (^V/2 - T 2 )! 2 

We now consider the number of no instances. There are N/2 — T images in 7Ti [N/2] 
from N—2T possible values. The number of possible permutations is the same as before 
of consistent no instances is 

/ N — 9T \ 

K no = ( N/2 J (N/2 - T^(N/2 - T 2 )! 2 (73) 

n/2-t) — \Nl2-2Tj so ^ no — -Kyes- This implies that when there are not any collisions it is 
always best to guess that the oracle is a no instance. Assume without loss of generality that T 2 > T\ . Then 
the probability of guessing incorrectly is at least the probability of a yes instance which is 



(72) 

— 7r 2 [iV/2] to choose 
. Hence, the number 
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Pt(X\ Xi ,...,x t )> k K l es K (74) 

^ no \ -t^yes 

> ^ (75) 



(N/2-T)\ 



2(N/2 ~ 2Ti)!(7V/2 - 2T 2 )! 
(N/2 - T) ■ ■ ■ (N/2 - 2T 2 + 1) 
2(AT/2 - 2Ti) • • • (N/2 - T + 1) 



(76) 
(77) 



1 / 7v/2-2r 2 + i \ T2 - Tl 

"2^ N/2 -2^ ) (78) 

l^/2-T-^^ whereg = r2 _ Ti (7g) 

1 / 2D \ D 

o I" ^ ^ , J (80) 



2 \N/2-T + D 

1 / 2L> 

2 V 1 ~ N/2-T + D 

1 / 2£> 2 

2 V A^/2 -T + D 

1 / 2T 2 

2 V N/2-T 



(83) 



Suppose T = o(Vn). In the limit, ^ ^1 — ^/^-t ) ~ I so asymptotically, the probability of an error 
given that no collision occurred is at least 

1 /T 2 \ 

Pr(j/es | X!,...,x T ) > - -O — (84) 



2 V N . 

All that remains is to show that the probability of a collision within the first T queries is small for 
T < N/4 and T = o(VN). Suppose the first t — 1 queries xi, . . . ,Xt-i do not contain any collisions. Then 
by the union bound, the probability of a collision at the t th query satisfies 

Pr(C t |a;i,...,s t _i)<-^-£ (85) 
Applying the union bound again, the probability of a collision in the first T queries is at most 

2T 2 

Pr(C) < (86) 
Therefore, asymptotically the probability of an error satisfies 

Pr(£)>i(l-0(T 2 /A)) (87) 

and is therefore unbounded. We conclude that no randomized algorithm can solve the loops problem 
with bounded error using less than Q(y/N) queries. □ 
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